CVE-2021-39711

What it actually does

Out-of-bounds read in bpf_prog_test_run_skb due to incorrect size value, enabling disclosure of adjacent kernel memory to a process with system privileges.

Why it matters to the business

On affected Android devices an attacker who already holds elevated system rights could obtain fragments of kernel memory; the issue has seen negligible real-world exploitation and carries low operational urgency.

How an attack unfolds

An attacker with system execution rights loads a specially crafted BPF program into the test-run interface, supplies an incorrect size parameter, triggers the out-of-bounds read, and exfiltrates the leaked kernel bytes through a user-space channel.

How to fix it

Update the Android kernel to a version containing the upstream fix for A-154175781; if a patched build is unavailable, restrict unprivileged access to BPF test-run interfaces via SELinux or seccomp policy.

How to confirm the fix worked

Verify the presence of the corrected bpf_prog_test_run_skb implementation in the running kernel; confirm that attempts to supply oversized test buffers no longer produce reads past the allocated skb.

Typical attack path

1. Obtain system-level execution on the target Android device
2. Invoke bpf_prog_test_run_skb with a malformed size argument
3. Read kernel memory beyond the intended buffer
4. Exfiltrate disclosed data to attacker-controlled storage

How to detect it

Review kernel audit logs and BPF-related system-call traces for repeated invocations of bpf_prog_test_run with anomalous size fields; look for processes running with system UID performing unexpected BPF test operations.

What your security team should do

• Prioritize kernel updates on devices that expose BPF test-run functionality
• Audit custom kernels or vendor images for the vulnerable test_run.c code
• Monitor upstream Android security bulletins for back-port announcements